A hash algorithm is a function which takes a variable size input and produces a fixed size output. The algorithm tries to make it difficult to predict the output for a given input, find two inputs with the same output, or reconstruct the input from the output.

learn more… | top users | synonyms (1)

0
votes
1answer
21 views

What is the difference between Key Derivation Function and (salted) Hash?

I see in this post that the main difference is that KDF outputs have "certain randomness properties", and I don't understand what does it mean. Suposing that that "certain randomness properties" are ...
2
votes
1answer
52 views

Is it secure to use pbkdf2 for both password hashing and key generation

I'm writing a password manager, right now for each individual site, I already used master password + random salt with PBKDF2 to generate encryption key to encrypt its password (each site has its own ...
2
votes
3answers
116 views

How does a hash which contains algorithm to choose can be secure?

I was thinking about creating my own hash+salt function, something like sha1(password + md5(login)), then I read here (part 4) that creating it's own hash+salt function is a bad idea, because if the ...
7
votes
2answers
79 views

Can client-side hashing improve after-the-fact security in response to password leaks?

Several questions on this site address client-side password hashing, and none of them admit to any security benefit beyond protecting other sites the user might use the same password for. However, ...
7
votes
2answers
1k views

Is it bad practice to ask only for individual characters of a password? [duplicate]

Some financial websites that I use use passwords in a peculiar way. Instead of asking me the whole password string, they only ask me to enter e.g. "3rd, 5th and 8th character of your password", i.e. a ...
1
vote
0answers
49 views

John The Ripper and OpenCL on AMD FirePro

Trying to work with John 1.8.0 Jumbo 1 I noticed that OpenCL won't work for me. I used autoconfig (meaning configure and build with the option to enable OpenMPI) in order to build JTR for my Mac Pro. ...
5
votes
1answer
112 views

Random padding in hash functions

In this answer, it was recommended that you add random padding when hashing messages for a trusted timestamp, such as for predictions, in order to avoid dictionary and brute force attacks (at least ...
1
vote
2answers
124 views

What if the Local Windows Cert Store is Compromised?

The diagram below illustrates chaining digital certificates up to a publicly trusted Root Certificate: I have been researching how trusted root authorities (such as GlobalSign or Verisign) are used ...
3
votes
1answer
76 views

What's the weakness of keyed-MD5 for message authentication?

I've seen public web API's using keyed-MD5 to generate message authentication code rather than adopting the HMAC algorithm. People wouldn't just invent HMAC for fun, so it must have some advantages ...
4
votes
1answer
135 views

Sending Encrypted Messages with Hybrid RSA, AES and HMAC SHA-256

Is this a Secure strategy for sending a large Encrypted Message using Hybrid RSA 2048, AES 256 and authenticated with HMAC SHA-256: Given the Alice already has Bob's RSA Public Key, Alice: ...
2
votes
1answer
95 views

Is it fine to store single-use beta keys plain-text?

Is it okay to store single-use beta keys in plain-text in the database? I'll be pre-generating and storing about 2M keys. The keys get passed around so that people can sign up with it, rather than let ...
2
votes
1answer
124 views

if a public key cannot decrypt the cipher text, then how can a private key?

I understand the "public" part of public key cryptography. Not the "private" part. For example, let's say our public key is %7 (modulo 7). And the message to be encrypted is 22. And we know that 22 ...
5
votes
5answers
2k views

Salted password + hash - is it really useful? [duplicate]

I am new to the topic and wanted to know the concept of having salted hashes before going down to the technical details. From what I have understand password - plaintext hash password - plaintext ...
-3
votes
0answers
49 views

How to determine what type of hash algorithm is used [duplicate]

My friend gave me a hashed/ encrypted ciphertext and I want to determine which hash algorithm is used. 3_HA{_[Kg742ea6zy.CT30:b:SX@:T]vf{2A<Mk9ab:@oU[VCOA_B5BI.9CqZ3tl I don't think this is a ...
4
votes
2answers
3k views

File security when encrypting files directly with the openssl command / and what about SHA1 hashing password first?

I've been using this command to encrypt files for a while now: openssl aes-256-cbc -a -salt -in secrets.txt -out secrets.txt.enc Then I type in a password. Can someone tell me, roughly speaking, ...
6
votes
3answers
20k views

Windows 7 Password Hash Security

I recently came across a number of sources that suggest that cracking Windows user account passwords is easy by examining their password hashes. I understand that these hashes are stored in the SAM ...
19
votes
7answers
4k views

Why not mix hashes?

To make hashes harder to target by specialized hardware, I intuitively imagine that mixing a set of different hash algorithms should provide additional strength. For simplicity lets assume Hash1 is a ...
4
votes
0answers
57 views

Sqlmap trimming output

I've decided to learn Sql/map but having an issue with Sqlmap trimming some of my output, the hash. The hash is about to be 32 characters long but I'm only getting 25 and the warning: [WARNING] ...
3
votes
1answer
94 views

How does hashcat figure out the SHA CRYPT ROUNDS on a Linux password

A part of my /etc/login.defs file looks like this: ENCRYPT_METHOD SHA512 # Define the number of SHA rounds. # If not specified, the libc will choose the default number of rounds (5000). # The values ...
5
votes
2answers
59 views

Understanding digitial certifications

q1) Does that mean that every time information is exchanged, both the original data + digital certification is sent? Meaning data + signature for each and every exchange. q2) Can any kind soul here ...
-3
votes
1answer
74 views

What type of hash is this MD4(MD4(($pass)).(strtolower($username))) [closed]

Can I decrypt this hash? Domain Cached Credentials: MD4(MD4(($pass)).(strtolower($username)))
8
votes
2answers
384 views

*NIX shadow file password format

I'm trying to get shell access to a router and have managed to retrieve its /etc/shadow file: root:$1$$N76hdwGfg11g0KdKbtyh21:0:0:root:/root:/bin/bash I've tried to use john to crack it but ...
2
votes
1answer
49 views

Distributed tokenization for credit card numbers

I have two locations within the same firm that hold credit card numbers. I want to be able to "join" on credit card number to do business analytics after transmitting card number-linked data from one ...
1
vote
1answer
17 views

Is the method of hardening the creation of a Cryptographically Generated Address (CGA) called hash extension

CGAs are sha1 hashes truncated to a 59 bit value. Along with a 3 bit security parameter they form a IPv6 address (more precisely the interface identifier). from wikipedia: The Sec parameter ...
4
votes
2answers
59 views

Determining strength of truncated HMAC

I have data stored on a device which I must guarantee integrity, for ease of explanation the data is like numerical field representing 'credit balance available'. The device only ever interacts with ...
8
votes
1answer
68 views

Is Rfc2898DeriveBytes using HMAC SHA1 still considered “secure enough” for hashing passwords?

I've been told by a CISSP that the .NET class Rfc2898DeriveBytes would not pass a security audit today because it still uses SHA1. It's reliance on SHA1 - even with the iterations - leaves it too ...
1
vote
1answer
37 views

Reproduce part of a hash

I know very little about hashes, but I was wondering if I know the first 20 digits of what got hashed and the first 8 digits of the hash, is there any way to figure out the entire hash? For example: ...
2
votes
1answer
101 views

How much does knowing the zxcvbn password strength help an attacker?

On an answer to the question How critical is it to keep your password length secret?, Mike Ounsworth commented that by storing the zxcvbn-calculated entropy of a password you make it easier for an ...
3
votes
2answers
114 views

Cryptographic algorithm to anonymise strings in pronounceable fashion?

NB: I originally posted this on SO (link), but then realise Security SE be more suitable, since there's existing questions around Crypto-PAn, which is similar here I have a logfile of database ...
2
votes
1answer
98 views

Is it insecure to provide a hash of an AES password?

I have made some software that encrypts and decrypts files using AES. I was wondering if it is safe to write a hash of the password to the file so that the program can check if a password is correct. ...
0
votes
1answer
32 views

Virtual Machine Integrity Hash Check

If I used virtualbox to create a snapshot template of a preconfigured linux machine and wanted to ensure that no one has tampered with my snapshot, could I simply keep a comparable hash of the VDI ...
4
votes
1answer
792 views

How can I extract the hash inside an encrypted PDF file?

As long as I know, the encrypted PDF files don't store the decryption password within them, but a hash asociated to this password. When auditing security, a good attemp to break PDF files passwords ...
6
votes
1answer
266 views

Any problems with scrypt yet?

In the question Do any security experts recommend bcrypt for password storage? Thomas Pornin recommends the hashing function scrypt but saying it is "too new to be recommended on a general basis". ...
0
votes
1answer
45 views

Can you resalt hash/rainbow tables after finding the salt for something?

After a rainbow/hash table is salted, is it possible to resalt it after finding the correct salt instead of generating it all over again? If not, what is preventing you from doing so? How can you find ...
0
votes
1answer
88 views

Rainbow tables/hash tables versus WPA/WPA2

In Wi-Fi penetration testing, is it possible to use rainbow tables/hash tables on WPA/WPA2 networks? Is there an advantage of one over the other? Where would one get said tables or can they be ...
2
votes
1answer
102 views

What is the difference between a hash table and a rainbow table, and how are they both used?

Is there much of a difference between the two tables? Can you get one from the other? (i.e. hash -> rainbow) How do they work? Are there different variables (in reference to speed, strength, ...
0
votes
2answers
78 views

Protect against malicious client with key derivation function (PBKDF2)?

Consider a protocol that allows clients to retrieve XML "forms" from a server. Forms are identified by a unique, randomly generated form ID that is embedded in the form. Clients fill out the form and ...
0
votes
1answer
51 views

Is this a secure hash “Function” for integrity?

I was wondering what were the posible security (not efficieny) issues with this hash "function": Although not an actual function, this method turns a message of any length into a message of fixed ...
3
votes
1answer
60 views

Secure text document's fingerprint

The purpose is the same as with hashing: given set of confidential documents, I want to process them and store something secure like salted hashes/bcrypt. Later, when new document is given, I want to ...
5
votes
1answer
157 views

Is Django's approach to password reset tokens secure?

I am implementing a password reset feature for a web application and am contemplating adopting an implementation similar to Django. In a nutshell, Django creates a token who is comprised of a ...
-1
votes
3answers
130 views

Authenticate User Salted Hash Without Username

I've got a page with a login system where you type your username and password, the salted hash gets pulled down from the database depending on the username ... SELECT hash FROM db WHERE username = ? ...
39
votes
5answers
16k views

How does hashing work?

I have been interested in Information Security. I was recently introduced to the idea of hashing. What I currently understand about hashing is that it takes the password a user enters. Then it ...
7
votes
3answers
2k views

How are leaked government credentials possible and what's the point?

In the wake of all these leaked/stolen/hacked government login/passwords being stolen it got me thinking. How is the leaking of these passwords even possible? Or are they of any real use? Aren't all ...
2
votes
1answer
75 views

Save Password length after hash to minimize calculation

Reading this topic How critical is it to keep your password length secret? following scenario comes to my mind: Assume I've a web application (PHP written using password_hash()) using salted password ...
3
votes
1answer
2k views

Parsing a PKCS7 detached signature hash

I'm trying to manually verify signatures of Apple iOS Passbook files, which are PKCS #7 detached signatures of the RSA key of the Apple developer who created the file. Which means there's a file ...
-2
votes
2answers
125 views

What are hashes that begin with $1$…? [closed]

I've found this hash and I'm wondering what is it. $1$h6k3X5db$pp8WQ5R5YYL5bNyQj2wP70
1
vote
1answer
61 views

Using username as salt safe enough? [duplicate]

Instead of creating a separate salt generator for each user, can't I just use their username as a salt? It would be unique for everyone, and achieves the purpose of the salts. <?php ...
31
votes
6answers
3k views

Does verifying identity by positions in passwords mean passwords are stored unhashed? [duplicate]

If authentication occurs by asking the user for the characters at certain positions in the password (such as: give the 3rd and 7th character in the password), does this imply that passwords are stored ...
0
votes
2answers
131 views

Weird 8-character hash [closed]

I'm investigating an application. In a XML file I came across: <ScrambledPassword>U8P3J2N1</ScrambledPassword> I ran it through a hash identification script which is telling me it's a ...
1
vote
3answers
86 views

How to identify hashes [closed]

How can I indentify a hash? Not with length only, I mean: as I know, specific hashes has specific charsets. Where can I find them? I need this information for making a hash indentification tool. (this ...